MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97b9b5c6ba4ebc1ae61c27dac9a76b2646f5be5690a71532676a1272fb28c102. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	97b9b5c6ba4ebc1ae61c27dac9a76b2646f5be5690a71532676a1272fb28c102
SHA3-384 hash:	72ce42bb4480683a89355243ae1545986ef7e8f55d952f8a1060734c5559258f332c07d595bf9ff677b998e140a7604a
SHA1 hash:	8154a5859fe0255e5a92f656c025c2e33be89ecb
MD5 hash:	45f385e76ffc2d5c7b6c2a7278cf9914
humanhash:	avocado-ceiling-football-louisiana
File name:	SecuriteInfo.com.Linux.Mirai.8362.28225.8588
Download:	download sample
Signature	Mirai Create hunting rule
File size:	67'860 bytes
First seen:	2024-05-02 12:35:26 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:qMre/z8u5mFGGTjSLOKrssJhPnlmVTClmQei:BrGz/qySerJhkVTClmLi
TLSH	T10C630254351DBCE1C6482B66A6B0D4C6B58119F9A2FF383B2AA05E40E733B15737336B
telfhash	t1219002b42cb950f360a180486280c33e6b15188456d5b4340d75449b4dc351040f1019
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	SecuriteInfoCom
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Mirai.8362.28225.8588.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Opens a port

Receives data from a server

Runs as daemon

Sends data to a server

Connection attempt

DNS request

Substitutes an application name

Deleting of the original file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

android anti-debug masquerade mirai

Link:

https://www.filescan.io/uploads/663388b6874e85cc566599fd/reports/301f394a-5cc9-4964-b62a-432d8611500e/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/97b9b5c6ba4ebc1ae61c27dac9a76b2646f5be5690a71532676a1272fb28c102

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/312520ae-c57c-4422-a4b7-3b81365b60ca

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1435330

Signature

Multi AV Scanner detection for submitted file

Sample deletes itself

Sends malformed DNS queries

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/97b9b5c6ba4ebc1ae61c27dac9a76b2646f5be5690a71532676a1272fb28c102

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/97b9b5c6ba4ebc1ae61c27dac9a76b2646f5be5690a71532676a1272fb28c102/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-05-01 18:22:40 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s643lrv2j26bvzq4e7nmtj3lezdplpswsctrkmthnijhf6ziyeba._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/240502-psw94abb35/

Behaviour

Unexpected DNS network traffic destination

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/97b9b5c6ba4ebc1ae61c27dac9a76b2646f5be5690a71532676a1272fb28c102

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	upx_antiunpack_elf32 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	UPX Anti-Unpacking technique to magic renamed for ELF32